tmcgov05 wrote:
> Thanks Chris,
>
> The Sniffer is monitoring the router interface closest to the FTP
> server (sender). I totally agree about getting a capture at the other
> end but unfortunately the receiver is another company and they are not
> cooperating very well. The strange thing is this: the problem goes
> away and I get a perfectly ordered packet capture when changing a
> static route on the aformentioned router from the HSRP virtual address
> to the physical address of WAN router 2. Note that WAN router 1&2 are
> connected with a /30 ethernet segment running OSPF and all traffic is
> designed to get routed over WAN router2. So when the virtual next-hop
> is used, there is that extra hop... which is obviously causing the
> problem... just can't figure out why. It doesn't that we dont have
> access to the WAN routers (provider managed).
>
> .3 (Primary)--------------WAN router 1
> ---------------->
> My Router------.5 (virtual HSRP)
> .4 (Secondary)--------------WAN router 2
> ----------------->

Interesting.

I presume you mean that the routers are connected with an *additional*
ethernet segment to the one where the HSRP router lives? The setup
you've described doesn't fit in a /30. Sounds like there is a
crossover cable between the WAN routers.

My guess:

You have a duplex mismatch on the crossover interfaces of the WAN
routers.

What would I do?

I'd get an ethernet tap on the crossover, and listen to the CDP
messages being advertised by each router. Those messages should tell
you the operating modes of each router's transceiver.

You can build a tap for just a few dollars:
http://www.snort.org/docs/tap/

/chris